RICHMOND, Virginia: President Joe Biden on Monday urged US companies to make sure their digital doors are locked tight because of 鈥渆volving intelligence鈥� that Russia is considering launching cyberattacks against critical infrastructure targets as the war in Ukraine continues.
Addressing corporate CEOs at their quarterly meeting, Biden told the business leaders they have a 鈥減atriotic obligation鈥� to harden their systems against such attacks. He said federal assistance is available, should they want it, but that the decision is theirs alone.
Biden said the administration has issued 鈥渘ew warnings that, based on evolving intelligence, Russia may be planning a cyberattack against us. ... The magnitude of Russia鈥檚 cyber capacity is fairly consequential, and it鈥檚 coming.鈥�
The president said the federal government is 鈥渄oing its part鈥� to prepare for an attack and warned the private-sector CEOs that it also is in the national interest that they do the same.
鈥淚 would respectfully suggest it鈥檚 a patriotic obligation for you to invest as much as you can鈥� in technology to counter cyberattacks, Biden told members of the Business Roundtable. 鈥淲e鈥檙e prepared to help you, as I said, with any tools and expertise we possess, if you鈥檙e ready to do that. But it鈥檚 your decision as to the steps you鈥檒l take and your responsibility to take them, not ours.鈥�
Biden鈥檚 top cybersecurity aide, Anne Neuberger, expressed frustration at a White House press briefing earlier Monday that some critical infrastructure entities have ignored alerts from federal agencies to fix known problems in software that could be exploited by Russian hackers.
鈥淣otwithstanding these repeated warnings, we continue to see adversaries compromising systems that use known vulnerabilities for which there are patches,鈥� said Neuberger, who is the president鈥檚 deputy national security adviser for cyber and emerging technologies. 鈥淭hat makes it far easier for attackers than it needs to be.鈥�
The federal government has been providing warnings to US companies of the threats posed by Russian state hackers since long before the country invaded Ukraine last month. The Cybersecurity and Infrastructure Security Agency has launched a 鈥淪hields Up鈥� campaign aimed at helping companies strengthen their defenses and has urged companies to back up their data, turn on multifactor authentication and take other steps to improve cyber hygiene.
Neuberger said there鈥檚 no intelligence suggesting a specific Russian cyberattack against US targets, but she did add that there has been increase in 鈥減reparatory activity,鈥� like scanning websites and hunting for vulnerabilities, that is common among nation-state hackers.
In an written statement earlier Monday, Biden said Russia could launch a cyberattack against US targets as retaliation for 鈥渢he unprecedented economic costs we鈥檝e imposed鈥� on Russia through sanctions.
鈥淚t鈥檚 part of Russia鈥檚 playbook,鈥� Biden said.
The United States and its allies have put a slew of sanctions in place aimed at crippling the Russian economy, and Biden recently announced the US is sending more anti-aircraft, anti-armor weapons and drones to help Ukraine.
John Hultquist, a vice president of intelligence analysis at the cybersecurity firm Mandiant, said cyberattacks gives Russia the ability to punch back.
鈥淐yberattacks are a means for them to exact costs without crossing a major red line,鈥� he said.
Russia is considered a hacking powerhouse but its offensive cyberattacks since it invaded Ukraine have been muted compared to what some feared. Russia has carried out significant cyberattacks against Ukraine in years past, including the devastating NotPetya attack in 2017 that spread far and wide and caused more than $10 billion in damage globally.
Neuberger said Russia cyberattacks against Ukraine are ongoing, though she did not provide specifics. She said the Biden administration has made clear there will be consequences if Russia engages with the US in cyberspace.
鈥淲e鈥檙e not looking for a conflict with Russia. If Russia initiates a cyberattack against the United States, we will respond,鈥� she said.
The Russian Embassy did not immediately respond to a request for comment.